From the flowers began to scold kill free-vulnerability warning-the black bar safety net

2008-05-18T00:00:00
ID MYHACK58:62200819081
Type myhack58
Reporter 佚名
Modified 2008-05-18T00:00:00

Description

The topic you read that right, and indeed from the flower began to scoldfree kill. Why you want to scold it, in fact because of recent school bored, so using a mobile phone on the QQ scurry. Not is I which nerve dislocation, is looking for a to teachfree killchat up(don't ask me how I make him talk to me..) is. This chat is it does not matter, indeed, is to put me out of my chair scared to the ground. Feel to write the whole 1 0 0 word, no point being serious, guys in the X to see the posts of the reader must be impatient with me why not start from the spend scoldfree killdoes, in fact, I must say I called instead offree to killthis technique, but some scold self-righteous guy on the Internet posing as a master, to mislead others. Now I put these people in the classic misleading released, but also give you a reminder, then the next time you encounter which"genius"said These, we can also, Hey Hey.....

1. The segment name is indicated a section name, it is only a section name. The 2 3 words let a fork be sure to firmly remember it. But the real decision section is its properties. May we all come across in addition to spend instruction time, encounter some of the local cannot write into the spending instructions, and then went to small-time to bother about added a big section. And I find that claim to be high in me to raise this issue, they began to speak with fervour and assurance talk about, what to say every time plus spend the time the first nop and then if you can not save it not spend. I believe he is definitely not the first to say so. But the real answer is what, and listen to me slowly come.... Because we are image files in the pe loader is mapped into memory, the pe loader will read the corresponding section of the table structure voffset vsize and properties. These values is decided that we mapped to the memory starting offset and size as well as the corresponding memory region attributes. In General our program is connected to the connector when the General will of the data segment is set to the data property, and the our code snippet set to the executable properties. These properties are irrelevant, we can totally own manual changes. For example say that all of our properties are set as readable, writable, and executable. So that we In addition spent the time to write the area will be very large, nor to small-time plus what section...

  1. Case not only is 4 line 3: Of course, as the students learn English is for sure, so guys forgive me for this simple title. I believe that many a fork of the modified case-method are particularly fond of it. In fact I also like so it. But you sure come across some places may not modify the case, so saying that those"masters"in and let's dish the same experience so some modifications to the case where it is depressed, then so said:"You take out what program is corrupt and the like to explain"why? Because they simply do not understand the function in our memory of the call. Here I generally say that two points

1. We can in some important ASCII character or string on the modified case. Such as what the message box of the ASCII.

  1. Another example is some of the output table the name of the function or some of the dynamic address acquisition the name of the function, these will certainly not modify the case, because of the different case of the the ASCII code is different. Now you fork the understand the uppercase and lowercase a real difference. 3, the frog is so cute?

I admit I'm not an environmentalist. Digress. In fact, I say the frog is the image of the parable of thefree to killin the feature code modify method, which looks like the earliest is 2 0 0 5 time of year are those that play a compilation of genius provides such as iceberg-like experience in a small corner, but we are now 0 for 8 years! 3 time everything can be rapid development, the virus also is. Now the antivirus does not like 0 5 0 6 time of year is just only the virus scan Avira, plus a lower of make people go crazy of the anti-virus engine. Now antivirus antivirus engine gradually tend to improve, also tends to be intelligent. For example now the flower is a very obvious characteristics of the virus, this thing you fork, fully can utilize the epo technology to escape the past and you can violence point A without any attribute of the segment.

Can't say that the jump method is fully as good as the subroutine call. Let's just say you can put your positioning feature code The part of the statement nop out, and then find the segment 0 area. Added a sub-program call. For example call to a memory address Then, in this memory address is stored is that you just nop out the instructions. Finally add a ret to return completely to be OK. Suchfree killthe effect is completely than is applied to the N-th jump is better, but not N times, is N+1 times. Today write so much. The job also how to write. The third view also understand how to paint, and tomorrow the computer's job is not yet done. Really can't give you written something more. In this to you apologize. Say a few words, well, actually, there are a number of ways. 0 8 years offree to killin fact, far from being the Proactive Defense so simple and now antivirus the anti-virus engine also in a step by step perfect, step-by-step intelligent. So do not understand the assembler does not understand the basic of these functions of the calling form does not have the pe structure of an in-depth analysis or even you are even tools are used to understand the"master", you best put the basics of playing better later in the out calling of teaching.....